Preventing And Detecting Fraud - EY

Preventing anddetecting fraudStrengthening the rolesof companies, auditorsand regulators

IntroductionContents02Introduction03 ho is responsibleWfor preventing anddetecting fraud?03 sing data, forensic,Ubehavioral analysisand training in the auditto detect fraud04How EY is evolvingthe audit to detect fraud05Promoting widercollaboration toeffect change07ConclusionIn his recent report on audit quality and effectiveness in the UK,Sir Donald Brydon described the question of fraud as “the mostcomplex and misunderstood in relation to the auditor’s duties.” 1While there have been a number of major corporate failuresas a result of fraud over the past few decades, it is importantto note that relative to the overall number of listed companiesthe figures are very small. These failures nevertheless reinforcethe need for more to be done to discourage and preventfraud and, where it cannot be prevented, to detect it as soonas possible.We recognize that, as part of ongoing improvement efforts,we need to evolve how we perform our audits to address fraud.Further, we are committed to leading the profession more widelyto address the questions that many stakeholders are askingabout the role of the auditor in fraud detection.We are already making progress. In fact, the actions we aretaking — mandating the use of data analytics for fraud testing,using additional internal and external data and information,using electronic confirmations for audit evidence whereverpossible, developing a proprietary fraud risk assessmentframework, mandating annual fraud training and requiring theuse of our forensic specialists in the audit on a targeted-riskbasis — go beyond currently accepted professional standards.Recognizing that auditors cannot succeed on their own, we setout a call to action to all members of the corporate governanceecosystem, including management, boards, audit committeesand regulators, to work with auditors on these issues, to improveaccountability and, where they do not exist already, to developtheir own initiatives to improve the prevention and detectionof fraud.12Assess, Assure and Inform: Improving Audit Quality and Effectiveness, December 2019,Report of the Independent Review into the Quality and Effectiveness of Audit.Preventing and detecting fraud: strengthening the roles of companies, auditors and regulators

Who is responsible for preventingand detecting fraud?The prevention and detection of fraud within a companyis primarily the responsibility of management under theoversight of those charged with the governance. Alongwith other members of the corporate governance andreporting ecosystem, auditors also play an important rolein detecting material fraud.Currently, auditors are responsible for providingreasonable assurance to shareholders that the financialstatements, taken as a whole, are free from materialmisstatement, whether caused by fraud or error. Publicopinion in many places though indicates that auditors areexpected to play a role that extends beyond providing thisreasonable assurance.2Using data, forensic, behavioral analysisand training in the audit to detect fraudNew opportunities to catch fraudsters are presentingthemselves. Companies have never been as data-richas they are today, potentially providing entirely newopportunities to detect material frauds through datamining, analysis and interpretation. Auditors are ideallyplaced to do this.Auditors are already increasingly using data analytics toidentify unusual transactions and patterns of transactionsthat might indicate a material fraud. At the same time,auditors still face challenges when it comes to acquiringand analyzing the relevant data from companies, eitherdue to systems infrastructure, formatting issues, or dataprivacy rules.Technology is not a panacea: an important humanelement also comes into play. There is an opportunityfor all involved, management and boards, auditors andregulators, to focus more on corporate culture andbehaviors to support fraud detection. The fraud triangle,3a generally accepted model used to consider the likelihoodof fraud risk, holds that three factors (opportunity,pressure and rationalization) provide the environment23for a fraud to occur. We believe that developments intechnology and research on human behaviors couldenhance an assessment of the pressureand rationalization elements. These results could feedinto a fraud risk assessment process. For example,consideration of the fraud triangle could in the futurebe part of a company's risk management and compliancesystem, and audit firms could deploy professionals withdifferent skills to look at all three factors (opportunity,pressure and rationalization) to enhance the ability todetect fraud. We would welcome a dialogue with allstakeholders to explore opportunities in this area.Auditors are already increasinglyusing data analytics to identifyunusual transactions and patternsof transactions that might indicatea material fraud.Closing the expectation gap in audit, ACCA, May 2019, summarizing the results of survey of 11,000 people across 11 different countries.Donald R Cressey, Other People’s Money, Montclair: Patterson Smith, 1973. Explains how fraud is more likely to take place when there is an opportunity tocommit the fraud in a concealed way (e.g., where there is a flattened management structure or limited approval processes); there are pressures (e.g., to appearto meet earnings to sustain investor confidence or personal financial problems); rationalization where the perpetrator justifies their actions to feel they areacceptable (e.g., “I need it more than they do”).Preventing and detecting fraud: strengthening the roles of companies, auditors and regulators3

There are also opportunities to boost auditors’professional skepticism and moral courage througheducation and training in topics such as behavioralscience, including the concepts of conscious andunconscious bias. These opportunities could haveprofound implications for auditor education andqualifications, as well as standards and audit regulationin the future.The use of forensic specialists in the audits of publicinterest entities may become mandatory in the future.In the UK, Sir Donald Brydon’s review of audit hassuggested that forensic skills and fraud awarenessshould be part of the formal qualifications and continuingprofessional development for all auditors. EY supportsthat recommendation, and as noted, is alreadymoving forward with enhanced procedures designedto detect fraud.How EY is evolvingthe audit to detect fraudWhere there is an incident of fraud, we seek tounderstand what we can learn from it to furtherenhance audit quality — regardless of whether theaffected business has been audited by us or anotherfirm. Drawing on both our skilled talent pool and ourstate-of-the-art technologies, we are developing ourauditing process to systematically go beyond standardpractice by: Mandating the use of data analytics for fraud testingin audits for all listed entities globally to enhance frauddetection capabilities and further develop professionalskepticism. We are already rolling out an approach touse data analytics throughout the audit process whichwill further bolster our ability to detect fraud.Where there is an incidentof fraud, we seek to understandwhat we can learn from it tofurther enhance audit quality.4 Using additional internal and external data andinformation to enable more nimble responses toexternal risk indicators, such as short sellers andwhistleblowers. Improving access to news andsocial media information will also assist in deepeningour independent and objective point of view, which iscritical in serving the public interest. Using electronic confirmations for audit evidencewherever possible, moving in time to matchingcompanies’ records of banking transactions with thoseprovided to EY directly by banks. Developing a proprietary fraud risk assessmentframework for use with audit committees and thosecharged with governance. Mandating annual fraud training for all auditprofessionals that incorporates the experiencesof our forensic professionals. Requiring the use of our forensic specialists in theaudits on a targeted-risk basis to assess potentialopportunities for fraud.Preventing and detecting fraud: strengthening the roles of companies, auditors and regulators

EY will also continue to work with boards, auditcommittees, standard setters, regulators and otherparties in the corporate governance and reportingecosystem to strengthen fraud detection. For example,in the US through the Center for Audit Quality, EY workswith the Anti-Fraud Collaboration, a combined effortwith Financial Executives International, the NationalAssociation of Corporate Directors and the Institutefor Internal Auditors. The Anti-Fraud Collaborationtakes collective action to improve financial fraudrisk management.Outside the US, EY is actively involved in efforts todetermine how professional standards for auditorsand others in the financial reporting ecosystem can beimproved to aid fraud detection. For example, we arecontributing to the International Auditing and AssuranceStandards Board consultation, as well as a numberof anti-fraud related debates in the EU, the UK, India,the Netherlands and South Africa, to name but a few.Promoting wider collaborationto effect changeWhen a fraud extends to a broad network acrossmanagement and third parties, it can take more than anormal audit to find the evidence. So, what can be doneto detect fraud as early as possible or even prevent it?We firmly believe that this goes far beyond the auditingprofession: we cannot succeed on our own. Large-scalefraud is mostly very well thought through and verydifficult to detect. Auditing is an important check, butit is not the only one. Nor should it be, if we are tomaximize the number of opportunities to prevent ordetect fraud as efficiently as possible. In this regard,we believe adopting a “three lines of defense” approachas recently coined by the European Commission is useful:namely (1) corporate governance, (2) the auditor, and(3) capital markets supervision.In this regard, we believe the following areas are ripefor exploration to drive better prevention or detectionof frauds. It is important to state that in some casesthese areas draw on best practices or requirementsfrom different countries around the globe, but we believethe public interest would be better served if they wereapplied more generally to public interest entities.To maximize the number ofopportunities to prevent or detectfraud, we believe the “three linesof defense” approach will be useful.Preventing and detecting fraud: strengthening the roles of companies, auditors and regulators5